PT-2025-10788 · Pimcore · Pimcore

Cancan101 · Published 2025-03-11 · Updated 2025-11-04 · CVE-2025-27617

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 11.5.4

Description: The issue allows authenticated users to craft a filter string that can cause a SQL injection. This is a problem with the Pimcore open source data and experience management platform.

Recommendations: For versions prior to 11.5.4, update to version 11.5.4 to resolve the issue. As a temporary workaround, consider restricting access to filter string functionality until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-27617

GHSA-QJPX-5M2P-5PGH

Affected Products

Pimcore

References · 11

• https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh · Vendor Advisory
• https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea · Patch
• https://osv.dev/vulnerability/CVE-2025-27617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27617 · Security Note
• https://osv.dev/vulnerability/GHSA-qjpx-5m2p-5pgh · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347 · Note
• https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47 · Note
• https://twitter.com/CVEnew/status/1899488077413835067 · Twitter Post
• https://t.me/cveNotify/141721 · Telegram Post
• https://t.me/cvetracker/18961 · Telegram Post